nico3333fr / CSP-useful

Collection of scripts, thoughts about CSP (Content Security Policy)
MIT License
486 stars 59 forks source link

Explained: extension schemes #70

Closed Zenexer closed 5 years ago

Zenexer commented 5 years ago

chrome-extension: will appear in reports when a Chrome extension attempts to inject a script, iframe, or other content into a page that doesn't explicitly allow the chrome-extension: scheme. If users are complaining that their extensions aren't working on your site, this is why. Oftentimes they're injecting questionable content (e.g., ads or analytics), in which case you may want to deliberately omit this.

moz-extension is the same thing, but for Firefox.

Depending on how the extension works and what browser is being used, about:blank or other about: URLs may appear instead of an extension scheme.

nico3333fr commented 5 years ago

Thanks a lot ;)